Weaknesses of type CWE-79

30,259 results

Injeção de conteúdo não sanitizado (XSS)

Ocorre quando dados não confiáveis (entrada de usuário, parâmetros, APIs externas) são inseridos diretamente no HTML, JavaScript ou contexto de renderização sem validação ou escape. Um atacante injeta código malicioso que executa no navegador da vítima, roubando cookies, sessões ou realizando ações em seu nome.

Example

Uma página de busca que exibe o termo procurado sem escape: se o usuário buscar por '<script>alert("hackeado")</script>', esse código é executado no navegador de quem visualizar o resultado. Um atacante pode injetar um script que rouba o token de autenticação.

How to mitigate

Escape ou encode toda entrada antes de renderizá-la (use funções nativas como textContent em JS, template engines com auto-escape como Jinja2 ou escapeHtml). Implemente Content Security Policy (CSP) para restringir execução de scripts inline. Valide e sanitize entrada no servidor, nunca confie apenas em validação client-side.

CVE-2025-22309MEDIUMWordPress SpeakOut! Email Petitions plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-8004HIGHStored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-5699MEDIUMDeveloper Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSSEPSS 0.3%CVE-2026-65914MEDIUMDOMPurify before 3.3.2 Mutation XSS via Re-ContextualizationEPSS 0.3%CVE-2024-7736HIGHReflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2024-41381MEDIUMmicroweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\modules\settings\admin.php.EPSS 0.3%CVE-2025-22310MEDIUMWordPress TemplatesNext ToolKit plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-115897LOWSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function bodyEPSS 0.3%CVE-2025-30203MEDIUMTuleap allows XSS via the content of RSS feeds in the RSS widgetsEPSS 0.3%CVE-2025-30907MEDIUMWordPress SecuPress Free plugin <= 2.2.5.3 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2024-39631HIGHWordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2025-7767MEDIUMPHPGurukul Art Gallery Management System edit-art-medium-detail.php cross site scriptingEPSS 0.3%CVE-2024-29109MEDIUMWordPress Shariff Wrapper plugin <= 4.6.10 - Contributor+ Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-14990CRITICALIBM DataPower Gateway affected by cross-site scriptingEPSS 0.3%CVE-2025-9753MEDIUMCampcodes Online Hospital Management System Patient Search patient-search.php cross site scriptingEPSS 0.3%CVE-2025-20211MEDIUMCisco BroadWorks Application Delivery Platform Software Cross-Site Scripting VulnerabilityEPSS 0.3%CVE-2026-109207HIGHRSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URLEPSS 0.3%CVE-2024-29865MEDIUMLogpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.EPSS 0.3%CVE-2025-9130MEDIUMUnify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout ShortcodeEPSS 0.3%CVE-2026-100182HIGHDownload Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin EditorEPSS 0.3%